CVE-2015-3105
published 2015-06-10CVE-2015-3105: Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144…
PriorityP184critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEVRansomware
Exploited in the wild
EPSS
96.08%
99.9th percentile
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | air | <= 17.0.0.172 | — |
| adobe | air | <= 17.0.0.144 | — |
| adobe | air_sdk | <= 17.0.0.172 | — |
| adobe | air_sdk_compiler | <= 17.0.0.172 | — |
| adobe | flash_player | <= 11.2.202.460 | — |
| adobe | flash_player | <= 13.0.0.289 | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_shader_drawing_fill.rb↗
- →Detect exploit delivery by monitoring HTTP responses serving a SWF file with Content-Type 'application/x-shockwave-flash' accompanied by Cache-Control and Pragma no-cache headers, consistent with the exploit module's response pattern. ↗
- →Look for HTML exploit pages embedding a SWF with FlashVars parameters named 'sh', 'pl', and 'os', which are characteristic of this exploit template. ↗
- →Monitor for requests to randomly named .swf files (short alpha strings, 4–6 chars) from browser processes, especially from IE11 or Firefox on Windows 7/8.1 or Linux, targeting Adobe Flash versions in the 17.0.0.x range. ↗
- →This vulnerability was actively exploited via the Magnitude Exploit Kit in June 2015; correlate web proxy logs for traffic patterns associated with Magnitude EK during that period. ↗
- →Flag Adobe Flash Player versions below 13.0.0.292 (Windows/OS X), below 11.2.202.466 (Linux), or 14.x–18.x below 18.0.0.160 as vulnerable to this memory corruption exploit. ↗
- ·The Metasploit module targets only x86 (32-bit) architecture; 64-bit environments are not covered by this exploit module. ↗
- ·The module restricts exploitation to Windows 7, Windows 8.1, and Linux targets; other OS versions are filtered out by the BrowserRequirements check. ↗
- ·On Windows, the exploit requires IE or Firefox as the browser; on Linux, only Firefox is supported by the module. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vulncheck10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rvwq-c757-x9gx: Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17
CVE-2015-3105 [HIGH] CWE-119 GHSA-rvwq-c757-x9gx: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
OSV
CVE-2015-3105: Adobe Flash Player before 13
osv·2015-06-10·CVSS 10.0
CVE-2015-3105 [CRITICAL] CVE-2015-3105: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
VulnCheck
Adobe Flash Player Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2015·CVSS 10.0
CVE-2015-3105 [CRITICAL] Adobe Flash Player Improper Restriction of Operations within the Bounds of a Memory Buffer
Adobe Flash Player Improper Restriction of Operations within the Bounds of a Memory Buffer
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Affected: Adobe Flash Player
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use
Red Hat
flash-plugin: multiple code execution issues fixed in APSB15-11
vendor_redhat·2015-06-09·CVSS 10.0
CVE-2015-3105 [CRITICAL] flash-plugin: multiple code execution issues fixed in APSB15-11
flash-plugin: multiple code execution issues fixed in APSB15-11
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
No detection rules found.
Exploit-DB
Adobe Flash Player - Drawing Fill Shader Memory Corruption (Metasploit)
exploitdb·2015-06-30
CVE-2015-3105 Adobe Flash Player - Drawing Fill Shader Memory Corruption (Metasploit)
Adobe Flash Player - Drawing Fill Shader Memory Corruption (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'Adobe Flash Player Drawing Fill Shader Memory Corruption',
'Description' => %q{
This module exploits a memory corruption happening when applying a Shader as a drawing fill
as exploited in the wild on June 2015. This module has been tested successfully on:
Windows 7 SP1 (32-bit), IE11 and Adobe Flash 17.0.0.188,
Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 17.0.0.188,
Windows 8.1, Firefox 38.0.5 and Adobe Flash 17.0.0.188, and
Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.460.
},
'License' => MSF_LICENSE,
Metasploit
Adobe Flash Player Drawing Fill Shader Memory Corruption
metasploit
Adobe Flash Player Drawing Fill Shader Memory Corruption
Adobe Flash Player Drawing Fill Shader Memory Corruption
This module exploits a memory corruption happening when applying a Shader as a drawing fill as exploited in the wild on June 2015. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 17.0.0.188, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 17.0.0.188, Windows 8.1, Firefox 38.0.5 and Adobe Flash 17.0.0.188, and Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.460.
Zscaler
Zscaler discovers Flash Player Vulnerabilities | 06-09-2015
blogs_zscaler
Zscaler discovers Flash Player Vulnerabilities | 06-09-2015
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
arXiv
CLIProv: A Contrastive Log-to-Intelligence Multimodal Approach for Threat Detection and Provenance Analysis
arxiv_fulltext·2025-07-12
CLIProv: A Contrastive Log-to-Intelligence Multimodal Approach for Threat Detection and Provenance Analysis
1
.001
[mode = title]CLIProv: A Contrastive Log-to-Intelligence Multimodal Approach for Threat Detection and Provenance Analysis
[1].
[1]Jingwen Li[style=chinese]
Conceptualization, Methodology, Writing–original draft
[1]organization=Beijing University of Posts and Telecommunications,
city=Beijing,
postcode=100876,
country=China
[1]Ru Zhang[style=chinese, orcid=0000-0001-6641-3236]
[1]
[email protected]
Supervision, Writing-Review & Editing
[1]Jianyi Liu[style=chinese]
Methodology, Writing-Review & Editing, Resources
[2]WanGuo Zhao[style=chinese]
Data curation, Resources
[2]organization=Beijing Anheng Xin'an Technology Co., Ltd,
city=Beijing,
postcode=100089,
country=China
[1]Corresponding author
## Abstract
With the increasing complexity of cyberattacks, the proactive and f
Bugzilla
CVE-2016-3105 mercurial: arbitrary code execution when converting git repos
bugzilla·2016-05-04·CVSS 9.8
CVE-2016-3105 [CRITICAL] CVE-2016-3105 mercurial: arbitrary code execution when converting git repos
CVE-2016-3105 mercurial: arbitrary code execution when converting git repos
A possible arbitrary code execution when converting Git repos was found in Mercirual. Mercurial prior to 3.8 allowed arbitrary code execution when using the convert extension on Git repos with hostile names. This could affect automated code conversion services that allow arbitrary repository names. This is a further side-effect of Git CVE-2015-7545.
External Reference:
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29
Upstream fix:
https://selenic.com/hg/rev/a56296f55a5e
Discussion:
Created mercurial tracking bugs for this issue:
Affects: fedora-all [bug 1332946]
Bugzilla
CVE-2015-3100 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 flash-plugin: multiple code execution issues fixed in APSB15-11
bugzilla·2015-06-09·CVSS 10.0
CVE-2015-3100 [CRITICAL] CVE-2015-3100 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 flash-plugin: multiple code execution issues fixed in APSB15-11
CVE-2015-3100 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 flash-plugin: multiple code execution issues fixed in APSB15-11
Adobe Security Bulletin APSB15-11 for Adobe Flash Player describes multiple flaws that can possibly lead to code execution when Flash Player is used to play a specially crafted SWF file.
Quoting from the APSB15-11:
These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-3100).
These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-3104).
These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2015-3105).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-3103, CVE-2015-3
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1086.htmlhttp://www.securityfocus.com/bid/75086http://www.securitytracker.com/id/1032519https://helpx.adobe.com/security/products/flash-player/apsb15-11.htmlhttps://security.gentoo.org/glsa/201506-01http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1086.htmlhttp://www.securityfocus.com/bid/75086http://www.securitytracker.com/id/1032519https://helpx.adobe.com/security/products/flash-player/apsb15-11.htmlhttps://security.gentoo.org/glsa/201506-01
2015-06-10
Published
Exploited in the wild